0xa0540019 Data Control: The maximum number of events per hour has been exceeded

Article ID:
110127

Rating:

3 customers rated this article 3.0 out of 6

Updated:
20 Jan 2014

Issue

The following error is shown against specific endpoints in Enterprise Console:

0xa0540019 Data Control: The maximum number of events per hour has been exceeded

First seen in

Enterprise Console 4.5.0

Cause

An endpoint computer can send a maximum of 50 data control events per hour back to the Enterprise Console. When this limit is reached this error message will be shown in the console. This only limits the number of events per hour that are sent to the console, all events are logged locally on the endpoint computer.

What To Do

No action is required, the logging of events to the console will resume when the frequency of alerts have reduced.

However, there may be situations where you want to increase the throttling or turn it off altogether. This can be done via the registry on the endpoint computer.

As an example, if we wanted to set the limit to 200:

On the Client machine open the Registry editor (Start | Run | Regedit | Select OK).

Browse to:HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\DataControl\

Right click and create a new DWORD value named 'EventThrottlingLimit' with a decimal value of 200 (or other chosen limit).

Alternatively you can turn off EventThrottling altogether , this maybe required in special circumstances where you want to ensure everything is captured at the console.

Note: Use this option with caution as this could considerably increase the number events reported back to the console depending on the number of endpoints it is deployed to.

To turn off event throttling:

On the Client machine open the Registry editor (Start | Run | Regedit | Select OK).

Browse to:HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\SAVService\DataControl\

Right click and create a new STRING value named 'EventThrottlingOn' and set the value to 'Off'